mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe
Size 1.3MB
Sample240523-lyrd9ace56
SHA256 453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6
MD5 c9fecce5ddbbb4c08036eb804806585a
SHA1 de118ddb2f2b644a73e314d1bfc9ff777b84c41c
SHA512 59be1a656c71b2dd3a2891a6b27e842f808074dffdd1b954d0ee781bab2183b048263e9381489223d97e74aff6cd8bfa825cab657c4b9aa9eba9d7f8d234faff
SSDEEP 24576:Iydmfk80iPrZsm2S05doZXri0tAnA+dzNpm5uQVMsi0:Pyk4ZPCU1And58pp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral5/memory/2832-28-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral5/memory/2832-29-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral5/memory/2832-31-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x000700000002344f-33.dat	family_redline
behavioral5/memory/4248-35-0x0000000000320000-0x000000000035E000-memory.dmp	family_redline

Executes dropped EXE 5 IoCs

pid	Process
4916	JD7oZ9jo.exe
4392	Yi0Qu7Ko.exe
2988	dT9yG7Sf.exe
2336	1Rs37xE9.exe
4248	2MK152qh.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	JD7oZ9jo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Yi0Qu7Ko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	dT9yG7Sf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2832	2336	1Rs37xE9.exe	93

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4916	1832	453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe	83
PID 1832 wrote to memory of 4916	1832	453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe	83
PID 1832 wrote to memory of 4916	1832	453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe	83
PID 4916 wrote to memory of 4392	4916	JD7oZ9jo.exe	84
PID 4916 wrote to memory of 4392	4916	JD7oZ9jo.exe	84
PID 4916 wrote to memory of 4392	4916	JD7oZ9jo.exe	84
PID 4392 wrote to memory of 2988	4392	Yi0Qu7Ko.exe	85
PID 4392 wrote to memory of 2988	4392	Yi0Qu7Ko.exe	85
PID 4392 wrote to memory of 2988	4392	Yi0Qu7Ko.exe	85
PID 2988 wrote to memory of 2336	2988	dT9yG7Sf.exe	86
PID 2988 wrote to memory of 2336	2988	dT9yG7Sf.exe	86
PID 2988 wrote to memory of 2336	2988	dT9yG7Sf.exe	86
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2336 wrote to memory of 2832	2336	1Rs37xE9.exe	93
PID 2988 wrote to memory of 4248	2988	dT9yG7Sf.exe	94
PID 2988 wrote to memory of 4248	2988	dT9yG7Sf.exe	94
PID 2988 wrote to memory of 4248	2988	dT9yG7Sf.exe	94

C:\Users\Admin\AppData\Local\Temp\453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe
"C:\Users\Admin\AppData\Local\Temp\453554affb4477ef1397310265a6a90ae0953e5bca58d9b7b98e7323e7cccdf6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JD7oZ9jo.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JD7oZ9jo.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yi0Qu7Ko.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yi0Qu7Ko.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dT9yG7Sf.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dT9yG7Sf.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Rs37xE9.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Rs37xE9.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2336
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2MK152qh.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2MK152qh.exe
        5⤵
        Executes dropped EXE
        
        PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

JD7oZ9jo.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JD7oZ9jo.exe
Size 1.2MB
SHA256 37bef7fe1c718f9ee1ffa18fe8fb3a516d1f464aaa536f02c18f1b63b58edd73
MD5 f0c7089254a00e815feae5d8181b7f05
SHA1 f3b024cb82395c32629ac49898728fd5010c26cf
SHA512 b8fa039c87837355afed88b3b77abfabda3d30a2e887adac620ac204eb6bc30bac809ed6092d837424f3a2c0324641d057c3f90e100634396bb0fa27d4e3f6e0
SSDEEP 24576:xy70kHI+fDIIPSqs/ZS8JO4ZyriltinAiUgNcdfpHTUW7:k70q8nqnnFsiBUqAN7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Yi0Qu7Ko.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Yi0Qu7Ko.exe
Size 762KB
SHA256 8a14bc158f2bab49eafd556bd51635a7102b322a4debb1f63fcb57dcb7f745f1
MD5 b4050b917e28921affbf2dffa8246e5c
SHA1 44d3497d429695898e5230916d0ef0924d97c660
SHA512 3680bf7579f36bcf440c349ea41f872bc36ca45297d1c384120844e86a3d8bf7e9c1af615dac4f6e93c5f32bcf3adfe95dbffaea802a2bcd2504395aa8abfa83
SSDEEP 12288:dMrJy90YtlbFbnI2pgPlDiHYUsvkSj21lyO3pAErFOZw5nzk1LIFg/j4:cydplIRPwpsvkSKgOfF/nA1M4U
MD5 SHA1 SHA512 SSDEEP

Submit Download

dT9yG7Sf.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dT9yG7Sf.exe
Size 565KB
SHA256 03dd8bac72407083fc3d0017dcb1f7733700c553eaf4676f4505b20fb1d34d99
MD5 4d6df12a24cadf74e6bf1190c60fdda2
SHA1 7eaadf868c91ab8138f20f300b3b1258c83608fe
SHA512 3421f21c5a3cb33a08a716de494a2cb58443b6a99cd47e13be3666a0ec671f48e50c032f0c8b96dbaa47bd77031b69c69ef29fb830b995f272f92eac1e8411a1
SSDEEP 12288:VMrFy907blq2vgPl6iH3UBbmSK8slGOPpAiryBZwt:IywwzPdEBbmS0kOFyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Rs37xE9.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1Rs37xE9.exe
Size 1.1MB
SHA256 cd17f994e3027975bda505f96d1b218bbbd059c472495be222437a7aae651292
MD5 7251c994d90ff3fd8068854ccd67a748
SHA1 3e536fbb4b8d12e90eb0a67a7f728ee1479d0f19
SHA512 87239c495e10298df1427c2dbaf1c8f93705f89e9bb95dfdd45554fe7cecee7e1bed80586369893262fd26f4d740fdb3de99cf7c3601375d68143765d26d841a
SSDEEP 12288:kH6avrN3Wv+fZp+DIH8zxFb2RahTUpBkdkC+Yuafgz67xXxDxtn4JWusbRU6U+xR:kl3Wv+fZp+DAEFb22wp7C+wxT4Jc9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2MK152qh.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2MK152qh.exe
Size 221KB
SHA256 7495e5e90c41793f72907b0e1355d97a867a0874b95c81804bd3f461a77e5996
MD5 f9b01336b5bc1df7afbd26b4df09d8e9
SHA1 b4d987a003e90420853d1c6a232e9dd0ba6f06ae
SHA512 77618a417fd858f1b195e0761f1fe3346569c0c7499879654c3333723dd9887a3242ccce36e8a751f051d7fdec6bfc4ad60e5610354bd7bf1dd1d038bdff36c3
SSDEEP 6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2832-28-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2832-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2832-31-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4248-35-0x0000000000320000-0x000000000035E000-memory.dmp

Download

memory/4248-36-0x00000000075F0000-0x0000000007B94000-memory.dmp

Download

memory/4248-37-0x00000000070E0000-0x0000000007172000-memory.dmp

Download

memory/4248-38-0x0000000002600000-0x000000000260A000-memory.dmp

Download

memory/4248-39-0x00000000081C0000-0x00000000087D8000-memory.dmp

Download

memory/4248-41-0x0000000007310000-0x0000000007322000-memory.dmp

Download

memory/4248-40-0x0000000007BA0000-0x0000000007CAA000-memory.dmp

Download

memory/4248-42-0x00000000074A0000-0x00000000074DC000-memory.dmp

Download

memory/4248-43-0x00000000074E0000-0x000000000752C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads